Junie
Monthly
Command execution in JetBrains Junie before version 252.549.29 allows local attackers to execute arbitrary commands by crafting malicious project files, requiring user interaction to open the file. The vulnerability affects all Junie versions prior to the patched release and exploits unsafe handling of project file content without proper sanitization.
In JetBrains Junie before 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.54, 251.284.54, 251.284.50, 243.284.54, 243.284.50 code execution was possible. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Information disclosure in JetBrains Junie, the AI coding agent embedded in JetBrains IDEs, allows the assistant's search_project function to surface data beyond its intended scope on affected builds released prior to 252.284.66, 251.284.66, and 243.284.66 (with the 252/251/243.284.61, .284.54, and .284.50 sub-builds also listed as vulnerable). The impact is confidentiality-only - no code execution, data modification, or denial of service - and the published 7.5 'High' rating reflects an AV:N/PR:N/UI:N vector that independent review considers overstated, since realistic exploitation depends on a local, low-privilege actor interacting with the agent or supplying content it processes. Exploitation risk signals are weak across the board: EPSS is 0.00% (0th percentile), the CVE is not in CISA KEV, and no public exploit code has been identified at time of analysis.
Command execution in JetBrains Junie before version 252.549.29 allows local attackers to execute arbitrary commands by crafting malicious project files, requiring user interaction to open the file. The vulnerability affects all Junie versions prior to the patched release and exploits unsafe handling of project file content without proper sanitization.
In JetBrains Junie before 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.54, 251.284.54, 251.284.50, 243.284.54, 243.284.50 code execution was possible. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Information disclosure in JetBrains Junie, the AI coding agent embedded in JetBrains IDEs, allows the assistant's search_project function to surface data beyond its intended scope on affected builds released prior to 252.284.66, 251.284.66, and 243.284.66 (with the 252/251/243.284.61, .284.54, and .284.50 sub-builds also listed as vulnerable). The impact is confidentiality-only - no code execution, data modification, or denial of service - and the published 7.5 'High' rating reflects an AV:N/PR:N/UI:N vector that independent review considers overstated, since realistic exploitation depends on a local, low-privilege actor interacting with the agent or supplying content it processes. Exploitation risk signals are weak across the board: EPSS is 0.00% (0th percentile), the CVE is not in CISA KEV, and no public exploit code has been identified at time of analysis.